# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://securelist.com/roaming-mantis-part-iv/90332/

171.244.33.114:53
171.244.33.116:53

# Reference: https://twitter.com/bad_packets/status/1112087547050520577

195.128.124.131:53
195.128.126.165:53

# Reference: https://twitter.com/bad_packets/status/1079251375987425280

66.70.173.48:53

# Reference: https://twitter.com/parseword/status/1093234498228097024

144.217.191.145:53

# Reference: https://twitter.com/bad_packets/status/1114236807367905280
# Reference: https://www.ixiacom.com/company/blog/paypal-netflix-gmail-and-uber-users-among-targets-new-wave-dns-hijacking-attacks

195.128.124.150:53
195.128.124.181:53

# Reference: https://twitter.com/ninoseki/status/1106842790351106048

1.53.252.164:53
1.53.252.215:53

# Reference: https://blog.talosintelligence.com/2019/04/seaturtle.html

95.179.150.101:53
ns1.intersecdns.com
ns2.intersecdns.com
ns1.lcjcomputing.com
ns2.lcjcomputing.com

# Reference: https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html (DNS Hijack Domains)

185.20.187.8:53

# Reference: https://twitter.com/david_jursa/status/1121719132137951232

23.94.149.242:53
172.245.14.114:53
198.46.131.130:53

# Reference: https://twitter.com/ninoseki/status/1127109264877600768

1.171.160.155:53
1.171.175.119:53

# Reference: https://twitter.com/david_jursa/status/1131487385034870784
# Reference: https://pastebin.com/s98awS0E

176.123.7.80:53
31.204.153.34:53

# Reference: https://myonlinesecurity.co.uk/it-looks-like-another-dns-compromise-hack-happening/

ns1.firstdnshoster.com
ns2.firstdnshoster.com
188.225.25.33:53
104.193.252.156:53
185.209.160.70:53
190.2.147.146:53
31.148.219.110:53

# Reference: https://habr.com/ru/company/bizone/blog/456804/ (Russian)

188.165.200.156:53
217.12.210.54:53
91.217.137.37:53

# Reference: https://twitter.com/ninoseki/status/1144557737516232705

118.30.28.38:53
118.30.28.39:53

# Reference: https://twitter.com/VK_Intel/status/1147276748331081728
# Reference: https://www.virustotal.com/gui/domain/jsc0nten1maker.com/relations

ns1.jsc0nten1maker.com
ns2.jsc0nten1maker.com
ns3.jsc0nten1maker.com
ns4.jsc0nten1maker.com
184.73.137.229:53
195.22.26.248:53
34.228.196.125:53
34.229.84.179:53
34.230.76.81:53
54.162.119.230:53
54.227.204.233:53
54.86.13.40:53
54.91.150.236:53
